Copied executable gains a logon launch setting, but restart is unproven
Sandbox reports identify a same-content copy of the submitted executable and a Run-key command aimed at launching it at logon. The command names a different Windows directory from the hash-identified copy, so the setting does not prove that copy ran; separate records show execution routes through a dropped executable and DLLs.
A Windows executable appears in sandbox output under the name PCSuite.exe, with exactly the same SHA-256 as the submitted sample. The same sample’s analysis records also identify two different executables written to disk. Is this simply a program changing location, or a source of additional execution routes? The evidence assembled by CTX Threat Intelligence supports the second interpretation.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read